mediumMultiple Choice
MS-102 Practice Question: Wants to delegate user creation to help desk…
An organization wants to delegate user creation to help desk staff without granting global admin rights. Which role should be assigned?
⚠ Common exam trap
Many exam-takers confuse Helpdesk Administrator with User Administrator because both can reset passwords, but only User Administrator can create users, which is the specific task required in the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
User Administrator
The User Administrator role is the correct choice because it grants the specific permissions needed to create and manage users and groups, including resetting passwords, without the broad privileges of Global Administrator. This role aligns with the principle of least privilege for help desk staff who need to perform user creation tasks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Global Administrator
Why it's wrong here
Global Administrator has unrestricted access to all Microsoft Entra ID administrative functions, including user creation, but it also grants the ability to manage security, billing, domains, and every other tenant setting. Delegating this to a help desk team is a serious security risk because it violates the principle of least privilege—help desk staff do not need to manage other administrators, conditional access, or tenant-wide configuration. While it would technically allow user creation, it is the wrong choice for a scoped delegation task.
- ✗
Helpdesk Administrator
Why it's wrong here
The Helpdesk Administrator role is scoped to password resets for non-administrative users, managing service requests, and monitoring service health—it does not include the Microsoft Graph permission to create or delete user objects. Therefore, a help desk agent assigned this role would be unable to provision new accounts, making it unsuitable for the task of user creation. This role is for supporting existing users, not for identity lifecycle management.
- ✗
License Administrator
Why it's wrong here
License Administrator can assign and remove license subscriptions and manage license-based groups, but its permission set does not include the ability to create new users in Microsoft Entra ID. This role operates only on existing directory objects, so while it is useful for managing licensing after accounts are created, it lacks the necessary 'microsoft.directory/users/create' permission. It is therefore an incomplete choice for delegating user creation.
- ✓
User Administrator
Why this is correct
User Administrator is the built-in role that includes the permissions to create and manage users and groups, reset passwords for non-administrators, and assign/remove licenses, which aligns directly with typical help desk provisioning tasks. It is a least-privilege-appropriate choice because it does not grant access to tenant-wide settings or the ability to manage other administrators. This makes it the correct built-in role for delegating user creation and license management to a help desk.
Go deeper
Related to this question
About these practice questions
One of 712 original MS-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MS-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MS-102 exam.